Germany’s Alternative für Deutschland (AfD) party is investigating a cyberattack after an unknown hacker claimed to have stolen hundreds of thousands of internal emails and documents. The suspected data theft has attracted widespread attention following the publication of an online archive containing alleged party correspondence, financial records and other sensitive information.
The AfD confirmed that a hosting provider used by the party was compromised in September 2026. According to a party spokesperson, attackers illegally copied information from a limited number of email accounts, most of which had reportedly been inactive for years. The party said the intrusion was quickly detected and stopped, and affected users were notified.
However, the scale of the alleged breach is considerably larger than the party’s initial description suggests. The attacker claims to have obtained more than 421,000 emails and over 100,000 files, with the stolen material reportedly distributed through a downloadable archive containing approximately 280GB of data.
The exposed correspondence allegedly includes accounts associated with prominent AfD figures, including party co-leader Alice Weidel and former chairman Alexander Gauland. German media outlets have also reported the presence of identification documents, bank statements, membership applications and internal party records.
An online platform has published an index of the alleged emails, accompanied by automatically generated summaries that categorize messages according to their contents. Some entries reportedly concern internal political disputes, racism, antisemitism and extremist statements. However, the authenticity and context of the individual messages have not been independently established.
The hacker has also claimed that an unidentified individual offered €100,000 to have the leaked information removed from the internet. No independent evidence has been presented to confirm the alleged offer or establish who might have made it.
The AfD maintains that current email accounts belonging to its federal organization were not affected. Nevertheless, German reporting indicates that at least one active regional party account may have been compromised, raising questions about the precise scope of the incident.
The identity of the attacker remains unknown, and investigators have not publicly established how the hosting provider was breached. The party is reviewing the published material to determine its authenticity and assess the consequences of the unauthorized disclosure.